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The MAILING DATE of this communication appears on the cover sheet with the correspondence address-- 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . □ This communication is responsive to 1 May 2006 . 

2. ^ The allowed claim(s) is/are 1-4.6-1 6, 18-20, and 23-26 (renumbered 1-22) . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a) DAN b)nSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4: □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 
INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. S CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) S including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings In the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be subnnitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 




□ 




1 . □ Notice of References Cited (PTO-892) 


5. 


Notice of Informal Patent Application (PTO-152) 


2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 


6. 


IS 


Interview Summary (PTO-413), 
Paoer No./Mail Date 050906 . 


3. □ Information Disclosure Statements (PTO-1449 or PTO/SB/08), 


7. 




Examiner's Amendment/Comment 


Paoer No./Mail Date 








4. □ Examiner's Comment Regarding Requirement for Deposit 


8. 


□ 


Examiner's Statement of Reasons for Allowance 


of Biological Material 




□ 






9. 


Other 



Harold E. Dodds, Jr. 
Patent Examiner 



U.S. Patent and Trademark Office 

PTOL-37 (Rev. 7-05) Notice of Allowability Part of Paper No./Mail Date 050906 



Application/Control Number: 09/987,912 Page 2 

Art Unit: 2168 

EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Should the 
changes and/or additions be unacceptable to applicant, an amendment may be filed as 
provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

2. Authorization for this examiner^s amendment was given in a telephone 
interview with Randy A. Noranbrock on 9 May 2006. 

3. The application has been amended as follows: 

In the Specification on line 13, delete Circu i ts for I nstrusion D e t e ction Systom 
before "(HP Docket No." 

In the Specification on line 13, insert Method of Detecting Critical File Changes 
before "(HP Docket No." 

In the Specification on line 14, delete on e v e n dat e h e r e w i th after "filed". 

In the Specification on line 14, insert November 16. 2001, Serial No. 09/887,911 
after "filed". 

In claim 1 on line 2, insert that after "or data". 
In claim 23 on line 2, insert that after "or data". 

4. The following changes to the drawings have been approved by the 
examiner and agreed upon by applicant: 

Applicant will provide a formal drawing for Figure 1 . 
In order to avoid abandonment of the application, applicant must make these 
above agreed upon drawing changes. 
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REASONS FOR ALLOWANCE 

5. The following is an examiner's statement of reasons for allowance: 
Examiner finds Applicants' arguments on page 7 of the "Amendment Under Rule 1 16" 
filed on 1 May 2006 concerning a method of generating kernel audit data persuasive as 
applied to amended independent claim 1 . The combinations of prior art from Crosbie et 
al. (U.S. Patent Application Publications No. US 2002/0083343) neither renders obvious 
nor anticipates the combination of recited elements in light of claim 1 . In particular, the 
above cited references neither renders obvious nor anticipates the combination of 
recited elements in the limitation "wherein the audit record is a tokenized audit record 
and tokens of the tokenized audit record are either primitive or composed". 

6. No combination of prior art renders obvious of anticipates the combination 
of recited elements in amended independent claim 23 in the limitation "auditing of the 
system should continue as specified in a post-call selection flag". 

7. Any comments considered necessary by applicant must be submitted no 
later than the payment of the issue fee and, to avoid processing delays, should 
preferably accompany the issue fee. Such submissions should be clearly labeled 
"Comments on Statement of Reasons for Allowance." 

CONCLUSION 

8. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Harold E. Dodds, Jr. whose telephone number is 
(571 )-272-41 1 0. The examiner can normally be reached on Monday - Friday 8:00 - 
4:30. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tim T. Vo can be reached on (571)-272-3642. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



Harold E. Dodds, Jr. 
Patent Examiner 
May 9, 2006 




Figure 1: IDDS Architecture Block Diagram 
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